-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Closed
Description
Describe the bug
ValidateSchema::evaluate is not thread safe. It is setting member variables of ValidateSchema
, in this case m_parserCtx
when this variable is used only once in the function. This causes a use-after-free error in the following scenario:
- T1 runs
[xmlSchemaNewParserCtxt](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L46)
- T2 runs
[xmlSchemaNewParserCtxt](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L46)
- T1 runs
[freeXmlSchemaParser](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L130)
- T2 runs
[freeXmlSchemaParser](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L130)
, causing a use-after-free on m_parserCtx
Expected behavior/fix
m_parserCtx
is no longer needed as a member, so we use a local variable instead.
Metadata
Metadata
Assignees
Labels
No labels